Senior Security Engineer - Detection & Response

Lambda, The Superintelligence Cloud, is a leader in AI cloud infrastructure serving tens of thousands of customers. Our customers range from AI researchers to enterprises and hyperscalers. Lambda's mission is to make compute as ubiquitous as electricity and give everyone the power of superintelligence. One person, one GPU.

Lambda Security protects some of the world's most valuable digital assets: invaluable training data, model weights representing immense computational investments, and the sensitive inputs required to leverage best of breed AI models. We're responsible for securing every byte that powers breakthrough artificial intelligence.

As a Senior Security Engineer - Detection & Response, you will serve as a hands-on technical expert on the Detection & Response team,acting as an intelligent backstop that ensures Lambda is the safest place to build with AI by catching security issues in real-time while enabling our business to move at hypergrowth velocity.

Key Responsibilities:

Detection Engineering & Threat Hunting:

• Design, build, and maintain robust detection rules, signatures, and behavioral analytics across Lambda's cloud, bare-metal, and internal infrastructure
• Conduct proactive threat hunting operations to uncover hidden threat actors, novel attack vectors, and zero-day vulnerabilities across multi-cloud and AI workloads
• Develop custom detection logic and playbooks as code, eliminating manual triage toil and reducing time-to-detect and time-to-respond
• Pioneer AI-powered detection and investigation workflows leveraging our internal LLM infrastructure to automate log analysis and threat intelligence context

Incident Response & Security Architecture:

• Lead technical incident response investigations for complex security events, performing deep-dive forensic analysis, root-cause identification, and containment
• Architect automated response capabilities and orchestration pipelines (SOAR) to programmatically isolate compromised assets and revoke compromised credentials
• Partner with Platform and Infrastructure engineering teams to harden systems, build security instrumentation, and ensure telemetry coverage across all services

Operational Execution & Continuous Improvement:

• Participate in an engineering on-call rotation to maintain 24/7 operational readiness and rapid incident containment
• Conduct post-incident reviews to extract technical learnings, drive root-cause remediation, and prevent recurring incidents
• Mentor junior and mid-level security engineers, sharing technical domain expertise and promoting best practices in detection engineering and automation

Requirements:

• 5+ years of hands-on security engineering experience specializing in detection engineering, threat hunting, or digital forensics and incident response (DFIR)
• Strong programming/scripting proficiency (e.g., Python, Go, Rust, or Bash) with a track record of building automated security tools and pipelines
• Deep technical knowledge of cloud infrastructure security (AWS/GCP), Linux system internals, container runtime security, and network telemetry
• Clear understanding of the unique requirements of securing a cloud infrastructure provider
• Proven experience writing detection rules (SIEM, YARA, Sigma, Falco, or EDR queries) and managing detections through software development best practices
• Hands-on experience conducting forensic investigations and triaging complex, multi-stage attacks across cloud environments
• Strong technical communication skills with the ability to document complex vulnerabilities, incident post-mortems, and architectural designs clearly

Nice to Have:

• Excitement about leveraging our direct access to state-of-the-art LLMs to revolutionize security operations,imagine AI-powered threat hunting, automated security report generation, and intelligent vulnerability prioritization at a scale only possible when you host the AI infrastructure yourself
• Experience building D&R programs at AI/ML companies
• Track record using AI/ML for security operations automation
• Background scaling security during hypergrowth (10x growth phases)
• Experience with eBPF, kernel-level telemetry, or specialized bare-metal host security tools
• Experience with both build and buy decisions for security tooling
• Experience driving or providing significant evidence for compliance audits, such as SOC 2, ISO 27001, PCI-DSS, HIPAA/HITECH, or FedRAMP